CYBERSECURITY ARCHITECTURE REFERENCE EDITION 2025

PROFESSIONAL REFERENCE GUIDE

Cybersecurity
Technologies
Handbook
A comprehensive reference for security architects, SOC analysts,
cybersecurity engineers, and consultants. Covers 50+ technologies
across 11 domains — explained clearly, without marketing language.

N ETW ORK SEC UR IT Y EN DP O IN T S E CU R ITY IDE NTI TY & A CCE SS CLO UD SEC URI TY

S ECU RIT Y OP ER AT I ON S A P PL I CA T IO N SEC URI TY THR EAT IN TEL LIG ENC E Z ERO TR UST

M ODE RN ARCH IT EC T UR E

Written for practitioners — security engineers, architects, SOC analysts, and pre-sales
consultants.
CHAPTER 01

Network Security
Network security technologies control, inspect, and monitor traffic flowing across an
organisation's infrastructure. They form the first line of defence — sitting between
untrusted external networks and internal assets, enforcing policies, and detecting
anomalies before an attacker reaches critical systems.

NETWORK SECURITY

Firewall
Packet Filter → Stateful → NGFW → Cloud Firewall

W H AT I T I S

A firewall is a network security device — hardware, software, or cloud-based — that monitors and
controls incoming and outgoing network traffic based on predefined security rules. It sits between
networks and decides what traffic is allowed to pass and what must be blocked.

WHY IT EXISTS

Without a firewall, every device connected to the internet is directly exposed to external traffic.
Attackers can freely probe open ports, exploit services, and establish connections to internal systems.
Firewalls enforce a controlled boundary — only explicitly permitted traffic enters or leaves the network.

W H E R E I T I S D E P LOY E D

Internet Edge — between the internet and the internal network (perimeter firewall)

Data Centre — between network zones (east-west traffic control)

Cloud — as virtual firewalls or cloud-native firewall services

Branch Office — at remote sites connecting to headquarters via WAN

KEY COMPONENTS

Policy Engine — evaluates traffic against rules (allow/deny/inspect)

Stateful Inspection Engine — tracks active connection state tables

Application Identification (App-ID) — identifies application traffic regardless of port

Threat Prevention — built-in IPS, antivirus, and URL filtering modules

SSL/TLS Decryption — decrypts encrypted traffic for deep inspection

 Management Console — centralised rule management and logging

H O W I T W O R K S — S T E P - BY- S T E P

FIREWALL PROCESSING WORKFLOW

1 A packet arrives at the firewall interface from the internet or internal network.

↓
2 The firewall reads the packet headers — source IP, destination IP, port, and protocol.

↓
3 The stateful engine checks if this packet belongs to an already-established, trusted connection.

↓
4 If new, the policy engine evaluates the packet against the rule base from top to bottom.

↓
5 On an NGFW, App-ID and User-ID also identify the application and user context.

↓
6 If a threat prevention profile is attached, the payload is inspected for exploits, malware, and C2
traffic.

↓
7 Traffic is allowed, dropped, or reset. All events are logged and forwarded to the SIEM.

T E C H N O LO GY E V O LU T I O N

FIREWALL EVOLUTION

1980s

Packet Filtering Firewall

Stateless — checks IP/port headers only. No awareness of connection state. Easily bypassed.

1990s

Stateful Inspection Firewall

Tracks TCP connection states. Blocks out-of-state packets. Significantly harder to spoof.

2000s

Application-Layer Firewall
Inspects payloads at Layer 7. Understands HTTP, FTP, DNS. Can block application-specific attacks.

2010s

Next-Generation Firewall (NGFW)

Adds integrated IPS, App-ID, User-ID, SSL inspection, threat intelligence feeds. Became the enterprise standard.

2020s

Cloud Firewall / Firewall-as-a-Service (FWaaS)

 Delivered from the cloud. Scales with traffic. Part of SASE architectures. Protects remote users and multi-cloud
environments without on-prem appliances.

R E A L- W O R L D AT TA C K S C E N A R I O

Scenario — Ransomware Lateral Movement via RDP

1. Attacker scans the internet and identifies an exposed RDP port (TCP 3389) on a company server.
2. Using a credential-stuffing attack with a leaked password list, the attacker authenticates
successfully.
3. The attacker moves laterally across the internal network using SMB shares and deploys ransomware.
4. Without a firewall restricting inbound RDP, the entire attack surface is exposed.

H O W T H E F I R E W A L L S T O P S T H E AT TA C K

Defence

• Perimeter firewall rule blocks inbound TCP 3389 from the internet — removes initial access vector.
• Internal firewall rules segment the network — an attacker who gains access to one machine cannot
reach the finance server because SMB (TCP 445) traffic between zones is blocked.
• Threat prevention profile detects the credential-stuffing pattern and blocks the session.
• All blocked events are logged and alerted to the SOC via SIEM integration.

I N T E G R AT I O N W I T H O T H E R S E C U R I T Y T O O L S

Firewall → sends syslogs / CEF events → SIEM

Threat Intelligence Platform → feeds threat indicators → Firewall
SOAR → pushes automated block rules → Firewall
NAC → user/device context → Firewall (User-ID)

POPULAR VENDORS

Palo Alto Networks Fortinet FortiGate Cisco Firepower

Check Point Juniper SRX Sophos XGS

AWS Network Firewall Azure Firewall

 NETWORK SECURITY

IDS & IPS

Intrusion Detection System / Intrusion Prevention System

W H AT T H E Y A R E

IDS (Intrusion Detection System) monitors network traffic for suspicious patterns and generates
alerts — but does not block traffic. It is a passive sensor. IPS (Intrusion Prevention System) sits inline
with traffic and can actively drop, block, or reset malicious sessions in real time.

WHY THEY EXIST

A firewall operates on rules — it allows or blocks based on IP, port, and protocol. It cannot detect a SQL
injection attack inside an HTTP request on port 80 that is already permitted. IDS/IPS sits deeper,
analysing the actual content and behaviour of traffic to catch attacks that firewalls miss.

W H E R E T H E Y A R E D E P LOY E D

IDS — connected to a SPAN/mirror port on a switch. Sees a copy of traffic. No risk of dropping
legitimate traffic.

IPS — deployed inline between network segments. Traffic physically passes through the IPS before
forwarding.

NGFW — most modern NGFWs have built-in IPS engines, eliminating the need for separate IPS
appliances in many environments.

KEY COMPONENTS

Signature Engine — matches traffic against known attack patterns (CVEs, exploits, malware C2)

Anomaly Detection Engine — baselines normal traffic and alerts on deviations

Protocol Decoder — reconstructs application-layer protocols (HTTP, DNS, SMB) for inspection

Policy Engine — determines action per rule: alert, drop, reset, quarantine

Management Console — rule tuning, alert triage, reporting

H O W I T W O R K S — S T E P - BY- S T E P

IPS INLINE PROCESSING

1 Network traffic enters the IPS inline sensor.

↓
2 The protocol decoder reconstructs the session and application-layer payload.

↓
 3 The signature engine compares the payload against thousands of known exploit and attack
signatures.

↓
4 The anomaly detection engine checks for behavioural deviations from established baselines.

↓
5 On a match, the configured action is taken — drop packet, block session, or generate an alert.

↓
6 Event details (signature name, CVE, source/destination, timestamp) are logged and forwarded
to SIEM.

T E C H N O LO GY E V O LU T I O N

IDS — Intrusion Detection System

Passive sensor. Detected known attacks via signatures. Alert-only. No blocking capability. High false positive rate.

IPS — Intrusion Prevention System

Moved inline. Added active blocking. Introduced anomaly detection. Problem: high-bandwidth environments
required expensive appliances.

NGIPS / NGFW-integrated IPS

IPS engines embedded inside NGFWs. Added application context, file reputation, sandboxing. Eliminated
standalone IPS appliances in many deployments.

NDR — Network Detection & Response

Evolved beyond signatures. Uses ML/AI and behavioural analytics. Detects encrypted threats and lateral movement
that IPS signatures cannot catch. Full-packet capture and retrospective analysis.

R E A L- W O R L D AT TA C K S C E N A R I O

Scenario — Log4Shell Exploitation Attempt

1. Attacker sends a crafted HTTP request containing a malicious JNDI lookup string targeting a
vulnerable Log4j instance.
2. The request travels over HTTPS on port 443 — a port the firewall permits.
3. The firewall allows the request because port 443 is whitelisted.
4. Without an IPS, the malicious payload reaches the application and triggers remote code execution.

H O W T H E I P S S T O P S T H E AT TA C K

Defence
 • The IPS signature engine has a specific rule for the Log4Shell pattern (CVE-2021-44228).
• When the malicious JNDI string is detected in the HTTP payload, the IPS drops the session.
• An alert is generated with the CVE reference, source IP, and payload sample.
• The alert is forwarded to SIEM, which correlates it with threat intelligence feeds to confirm the known
exploit pattern.

I N T E G R AT I O N W I T H O T H E R S E C U R I T Y T O O L S

IPS → alert events → SIEM

Threat Intelligence → signature/indicator updates → IPS
SOAR → automated rule push → IPS

POPULAR VENDORS

Palo Alto (integrated) Cisco Secure IPS Snort / Suricata

Trend Micro TippingPoint Fortinet FortiIPS Check Point IPS

NETWORK SECURITY

NDR — Network Detection & Response

Behavioural network analytics with response capability

W H AT I T I S

NDR monitors all network traffic — including encrypted sessions — using machine learning, behavioural
analytics, and threat intelligence to detect threats that signature-based tools miss. Unlike IPS, NDR
does not just look for known attack patterns — it identifies anomalous behaviour such as unusual
lateral movement, abnormal data flows, and encrypted C2 communications.

WHY IT EXISTS

Modern attackers "live off the land" — using legitimate tools and protocols (RDP, WMI, PowerShell) that
signature-based IPS cannot flag. Encrypted traffic has grown to over 90% of internet traffic, making
deep packet inspection less effective. NDR was built to detect these modern evasion techniques
through behavioural modelling of what normal network activity looks like — and alerting when
something deviates.
KEY COMPONENTS

Network Sensors / Probes — deployed at key network points for full-packet capture or NetFlow
analysis

ML Analytics Engine — models baseline traffic behaviour per subnet, user, and device

Threat Intelligence Integration — correlates flows with known bad IPs, domains, and certificates

Detection Library — covers MITRE ATT&CK techniques mapped to network observables

Response Module — integrates with firewalls, NAC, or SOAR to block/isolate automatically

H O W I T W O R K S — S T E P - BY- S T E P

NDR DETECTION WORKFLOW

1 NDR sensors capture raw packets or NetFlow/IPFIX data across north-south and east-west
traffic.

↓
2 The analytics engine builds per-entity behavioural models: what is normal for this workload,
subnet, or user?

↓
3 ML models detect statistical outliers — e.g., a workstation initiating SMB connections to 200
internal hosts in 60 seconds (ransomware spreading).

↓
4 Threat intelligence feeds are cross-referenced — does any destination IP or domain match
known C2 infrastructure?

↓
5 High-confidence detections trigger automated responses — firewall ACL push, endpoint
quarantine via EDR integration, or SOAR playbook.

↓
6 Full detection context (MITRE ATT&CK mapping, forensic PCAP, timeline) is sent to the SIEM
and SOC analyst dashboard.

POPULAR VENDORS

Darktrace Vectra AI ExtraHop Reveal(x)

Corelight Cisco Secure Network Analytics Palo Alto Cortex XDR

 NETWORK SECURITY

Secure Web Gateway (SWG)

Proxy → SWG → CASB → SSE

W H AT I T I S

A Secure Web Gateway is an inline security checkpoint that inspects all outbound web traffic from
users. It enforces acceptable use policies, filters malicious URLs and categories, performs SSL
inspection, and blocks malware downloads before they reach the endpoint.

WHY IT EXISTS

Users browsing the web are a primary infection vector — drive-by downloads, malicious redirects, and
phishing pages regularly bypass endpoint AV. The SWG sits between the user and the internet, acting
as a security-aware proxy that can see, inspect, and block content before it reaches the device.

KEY COMPONENTS

URL Filtering Engine — categorises URLs (gambling, malware, phishing, social media) and enforces
policy

SSL/TLS Inspection — decrypts HTTPS traffic for content inspection (man-in-the-middle proxy)

Anti-Malware Engine — scans file downloads against AV signatures and reputation feeds

Sandboxing Integration — unknown files are detonated in a sandbox before delivery

DLP Module — inspects outbound traffic for sensitive data exfiltration over HTTP

Cloud App Control — applies usage policies to SaaS apps (upload/download controls)

T E C H N O LO GY E V O LU T I O N

Web Proxy
Basic HTTP proxy. Cached content. No security inspection. Users routed through it for performance.

Secure Web Gateway (SWG)

Added URL filtering, malware scanning, SSL inspection, application controls. Became the primary web security
control.

CASB Integration
SWG capabilities extended to cover SaaS applications — shadow IT discovery, data protection in cloud apps.

Security Service Edge (SSE)

SWG + CASB + ZTNA delivered as a unified cloud service. No on-prem proxy appliances. Users connect directly to
SSE regardless of location.

POPULAR VENDORS
 Zscaler ZIA Netskope SWG Palo Alto Prisma Access

Cisco Umbrella Symantec Web Security Forcepoint SWG

NETWORK SECURITY · REMOTE ACCESS

VPN → ZTNA → SASE

Remote access security evolution

V P N — V I R T U A L P R I VAT E N E T W O R K

A VPN creates an encrypted tunnel between a remote user's device and the corporate network. Once
connected, the user has broad network access as if they were physically on-site. VPNs are simple to
deploy but fundamentally trust any authenticated user — once inside, lateral movement is largely
unchecked.

ZTNA — ZERO TRUST NET WORK ACCESS

ZTNA replaces VPN with a model where every access request is verified individually — per application,
per session. Users are never given broad network access. Instead, they are granted access only to the
specific application they need, and only after their identity, device health, and context are verified. This
drastically limits lateral movement.

Key Difference from VPN: VPN grants network access. ZTNA grants application access. The internal
network is never exposed to the user.

S A S E — S E C U R E A C C E S S S E RV I C E E D G E

SASE (pronounced "sassy") is a framework defined by Gartner that converges network security (SWG,
CASB, ZTNA, FWaaS) and WAN connectivity (SD-WAN) into a single cloud-delivered service. Instead of
routing all traffic through a central data centre, users connect to the nearest SASE point-of-presence,
which applies security policy inline and routes optimally to the destination.

T E C H N O LO GY E V O LU T I O N

IPSec VPN
Site-to-site encrypted tunnels. Fixed infrastructure. Complex to manage. Not suitable for mobile workers.

SSL VPN / Remote Access VPN

 Browser-based or client-based. Worked for mobile users. Still granted broad network access — significant attack
surface if credentials were stolen.

ZTNA — Zero Trust Network Access

Per-application access control. Continuous identity and device verification. Network never exposed. Eliminates
lateral movement risk from compromised VPN credentials.

SASE — Secure Access Service Edge

Full network + security convergence in the cloud. SD-WAN + SWG + CASB + ZTNA + FWaaS. Optimised for cloud-
first, remote-first organisations.

POPULAR VENDORS

Zscaler ZPA (ZTNA) Palo Alto Prisma Access Netskope SASE

Cisco SD-WAN + Umbrella Cloudflare Access Fortinet SASE

CHAPTER 02

Endpoint Security
Endpoints — laptops, desktops, servers, and mobile devices — are the primary targets in
most attacks. Endpoint security technologies protect these devices from malware,
exploits, and attacker activity. They have evolved from simple antivirus scanners to
sophisticated behavioural detection and response platforms.

ENDPOINT SECURITY

Antivirus & Next-Generation Antivirus (NGAV)

Signature-based → Heuristic → ML-based detection

T R A D I T I O N A L A N T I V I R U S — W H AT I T I S

Traditional antivirus (AV) identifies malware by comparing files against a database of known malicious
signatures — unique byte patterns extracted from previously identified malware. It is the oldest form of
endpoint security and is effective only against known, previously catalogued threats.

L I M I TAT I O N S O F T R A D I T I O N A L AV

Requires constant signature updates — zero-day malware is invisible until a signature is published

Fileless malware (living in memory only) has no file to scan

Polymorphic malware changes its byte pattern with each infection — defeating signature matching

Packed or obfuscated executables can evade static analysis

N E X T- G E N E R AT I O N A N T I V I R U S ( N G AV ) — W H AT I T I S

NGAV adds machine learning and behavioural analysis to endpoint protection. Rather than looking for
known signatures, it models what malicious behaviour looks like — process injection, privilege
escalation, unusual child process creation — and detects threats based on those patterns regardless of
whether the file has been seen before.

K E Y N G AV T E C H N I Q U E S

Machine Learning Models — trained on millions of benign and malicious samples to predict
maliciousness of new files

Pre-Execution Analysis — examines file attributes and structure before it is run

Behavioural Monitoring — watches process behaviour at runtime — memory allocation patterns, API
call sequences, network connections

Script Blocking — prevents malicious PowerShell, VBScript, and macro execution

 Memory Protection — detects shellcode and exploit techniques (ROP chains, process hollowing)

T E C H N O LO GY E V O LU T I O N

Signature-Based Antivirus
Matched files to a hash or byte-pattern database. Effective only against known malware. Required daily signature
updates.

Heuristic / Behavioural AV
Analysed file structure and behaviour for suspicious characteristics. Improved zero-day coverage but high false
positive rates.

Next-Generation Antivirus (NGAV)

Machine learning-based. No signature database required. Pre-execution + runtime analysis. Effective against zero-
days, polymorphic malware, fileless attacks.

EDR with NGAV integrated

Prevention + detection + response unified in a single platform. Full attack timeline visibility with automated
remediation capability.

POPULAR VENDORS

CrowdStrike Falcon Prevent SentinelOne Singularity Microsoft Defender

Carbon Black NGAV Cylance (Blackberry) Malwarebytes

ENDPOINT SECURITY

EDR — Endpoint Detection & Response

Continuous recording · Behavioural detection · Forensic investigation

W H AT I T I S

EDR continuously records all activity on an endpoint — every process creation, file modification,
registry change, network connection, and user action — and stores it in a searchable data lake. It
applies behavioural detection rules and ML models to this telemetry in real time, alerts on suspicious
activity, and provides analysts with the tools to investigate and respond to incidents directly from the
platform.

WHY IT EXISTS
When an attacker is already inside an endpoint, antivirus alone cannot detect them. An attacker using
legitimate tools (WMI, PowerShell, certutil) leaves no malicious files for AV to scan. EDR was designed
to answer the question: what is happening on this endpoint right now and over the past 90 days? It
provides continuous visibility even for fileless and living-off-the-land attacks.

KEY COMPONENTS

Lightweight Agent — installed on every endpoint. Collects telemetry with minimal performance impact.

Cloud Data Lake — stores months of endpoint telemetry for investigation and threat hunting

Detection Engine — behavioural rules, ML models, and MITRE ATT&CK-mapped indicators of attack

Investigation Console — process trees, attack timelines, file quarantine, memory analysis

Response Actions — isolate host, kill process, delete file, block hash, push remediation script

Threat Hunting Interface — SQL-like query language over the telemetry data lake (e.g., CrowdStrike's
Falcon Query Language)

H O W I T W O R K S — S T E P - BY- S T E P

EDR DETECTION & RESPONSE WORKFLOW

1 The EDR agent on the endpoint records all system events continuously and streams them to the
cloud platform.

↓
2 A user executes a file that invokes PowerShell, which then downloads a payload from an
external URL.

↓
3 The detection engine flags this behaviour pattern: "Office application spawning PowerShell that
makes a network connection" — a known attack technique (T1059.001).

↓
4 A high-severity alert is generated with the full process tree, command line arguments, and
network destination.

↓
5 The analyst reviews the attack timeline. The host is isolated from the network with a single
click.

↓
6 The malicious process is killed, the dropped file is quarantined, and the file hash is globally
blocked across all org endpoints.

↓
7 The incident and all telemetry is forwarded to the SIEM for correlation with other events across
the environment.
R E A L- W O R L D AT TA C K S C E N A R I O

Scenario — Spear Phishing Leading to Cobalt Strike

1. Attacker sends a spear-phishing email with a malicious Word document containing a macro.
2. User enables macros — the macro executes a PowerShell script that downloads a Cobalt Strike
beacon payload.
3. The beacon establishes an encrypted C2 channel over HTTPS.
4. Attacker uses the beacon to perform reconnaissance, dump credentials (Mimikatz), and move
laterally to a domain controller.

H O W E D R S T O P S T H E AT TA C K

Defence

• EDR detects the Word → PowerShell → network download chain as malicious behaviour (MITRE
T1566.001, T1059.001, T1105).
• The PowerShell execution is blocked before the beacon downloads.
• If the beacon does execute, EDR detects the encrypted C2 communication pattern and the process
injection technique used.
• The host is auto-isolated. Mimikatz execution attempt is blocked by memory protection modules.
• The complete attack chain is presented to the SOC analyst as an annotated process tree with MITRE
ATT&CK mappings.

I N T E G R AT I O N W I T H O T H E R S E C U R I T Y T O O L S

EDR → alert + telemetry → SIEM

SOAR → orchestrates host isolation → EDR API
Threat Intelligence → hash/IOC feeds → EDR
EDR → telemetry feed → XDR Platform

POPULAR VENDORS

CrowdStrike Falcon SentinelOne Singularity Microsoft Defender for Endpoint

VMware Carbon Black Palo Alto Cortex XDR Cybereason

Trellix
 ENDPOINT · NETWORK · CLOUD SECURITY

XDR — Extended Detection & Response

Unified detection across endpoint, network, identity, and cloud

W H AT I T I S

XDR extends EDR's telemetry collection beyond the endpoint to include network, cloud, email, identity,
and application data — all correlated in a single platform. The purpose is to break down the data silos
between security tools and give analysts a unified view of an attack that spans multiple vectors
simultaneously.

WHY IT EXISTS

Modern attacks span multiple domains: a phishing email delivers a payload to an endpoint, the
attacker then uses compromised credentials to access a cloud app, and exfiltrates data through the
network. Investigating this across separate EDR, SIEM, email security, and cloud security consoles is
slow and error-prone. XDR stitches these signals together automatically and presents the complete
attack story.

K E Y C A PA B I L I T I E S

Cross-domain alert correlation — automatically links related events from endpoint, network, and cloud

Unified investigation interface — single pane of glass for the complete attack timeline

Automated root cause analysis — identifies the patient zero and initial attack vector

Coordinated response — simultaneously isolate endpoint, revoke cloud credentials, and block network
indicators

N AT I V E X D R V S . O P E N X D R

Native XDR — integrates telemetry only from the vendor's own products (e.g., CrowdStrike pulls from
Falcon Endpoint + Falcon Firewall + Falcon Identity). Deep integration, less flexibility. Open XDR —
ingests telemetry from any vendor. Requires more integration work but fits organisations with multi-
vendor environments.

POPULAR VENDORS

Palo Alto Cortex XDR CrowdStrike Falcon XDR SentinelOne Singularity XDR

Microsoft Defender XDR Trend Micro Vision One Trellix XDR

CHAPTER 03

Identity & Access Security

Identity has become the new perimeter. With users accessing applications from any
device and any location, traditional network boundaries no longer protect resources.
Identity security technologies ensure that only the right people, with the right context,
can access the right resources — and that all access is continuously verified.

IDENTITY SECURITY

IAM — Identity & Access Management

Who are you, and what are you allowed to do?

W H AT I T I S

IAM is the framework of policies, processes, and technology that manages digital identities and
controls what each identity can access. It answers two fundamental questions: who is this user?
(authentication) and what are they allowed to do? (authorisation).

C O R E I A M C A PA B I L I T I E S

Identity Lifecycle Management — provisioning, modifying, and deprovisioning user accounts across
systems

Authentication — verifying user identity via passwords, MFA, certificates, or biometrics

Single Sign-On (SSO) — one login grants access to multiple connected applications via SAML or
OAuth/OIDC

Role-Based Access Control (RBAC) — permissions are assigned based on job role rather than per-user

Attribute-Based Access Control (ABAC) — permissions evaluated based on user attributes, resource
attributes, and context (time, location, device)

Directory Services — centralised user store (Active Directory, LDAP, cloud directory)

T E C H N O LO GY E V O LU T I O N

Username + Password
Single factor. Easily stolen, phished, or brute-forced. Still the most common attack vector today.

Multi-Factor Authentication (MFA)

Added a second factor — OTP token, push notification, or hardware key. Significantly reduces account takeover risk.

Identity & Access Management (IAM)

 Centralised identity governance across all applications. SSO, RBAC, lifecycle management, audit logging.

Privileged Access Management (PAM)

Special controls for admin and service accounts — vaulting, session recording, just-in-time access.

Zero Trust Identity

Continuous verification. Every access request is evaluated in context — identity, device posture, location, behaviour.
No implicit trust ever granted.

POPULAR VENDORS

Okta Microsoft Entra ID Ping Identity

SailPoint IBM Security Verify ForgeRock

IDENTITY SECURITY

MFA — Multi-Factor Authentication

Something you know · Something you have · Something you are

W H AT I T I S

MFA requires users to present two or more independent verification factors before access is granted.
Even if an attacker steals a password, they cannot authenticate without the second factor. MFA is one
of the single highest-impact security controls an organisation can implement — it blocks over 99% of
automated account takeover attacks.

M FA FA C T O R T Y P E S

Something you know — password, PIN, security question

Something you have — hardware token (YubiKey), authenticator app (TOTP), SMS OTP, push
notification

Something you are — fingerprint, face recognition, iris scan

M FA W E A K N E S S E S A N D M I T I G AT I O N S

MFA is not infallible:

• MFA Fatigue — attackers spam push notifications until the user approves one. Mitigation: number
matching MFA, phishing-resistant FIDO2.
 • SIM Swapping — attacker hijacks victim's phone number to receive SMS OTPs. Mitigation: avoid SMS
OTP; use authenticator apps or hardware keys.
• MITM Phishing Proxies — AiTM (adversary-in-the-middle) attacks steal session tokens after MFA is
completed. Mitigation: FIDO2/passkeys, Conditional Access policies binding sessions to device.

P H I S H I N G - R E S I S TA N T M FA

FIDO2/WebAuthn and hardware security keys (YubiKey, Google Titan) are considered phishing-
resistant because the authentication is cryptographically bound to the specific website — a fake
phishing site cannot relay the authentication to the real site. This is the strongest form of MFA currently
available.

POPULAR VENDORS

Duo Security (Cisco) Okta MFA Microsoft Authenticator

Yubico YubiKey RSA SecurID Google Titan Key

IDENTITY SECURITY

PAM — Privileged Access Management

Controls for admin, root, and service accounts

W H AT I T I S

PAM secures, controls, monitors, and audits access to privileged accounts — domain administrators,
root accounts, service accounts, and emergency access credentials. Privileged accounts have the keys
to the kingdom; if compromised, an attacker can disable security controls, exfiltrate data, and encrypt
systems with minimal resistance.

C O R E PA M C A PA B I L I T I E S

Password Vaulting — privileged credentials are stored encrypted in a vault. Users never see the actual
password — they request access and the vault injects credentials automatically.

Session Recording — all privileged sessions (RDP, SSH, database console) are recorded in full for audit
and forensic purposes.

Just-In-Time (JIT) Access — admin accounts are created on-demand for a specific task, then
automatically deleted. Reduces standing privileges.
 Least Privilege Enforcement — users are granted only the minimum permissions needed for their
specific task.

Credential Rotation — passwords are automatically rotated on a schedule or after each use, preventing
credential reuse.

R E A L- W O R L D AT TA C K S C E N A R I O

Scenario — Credential Theft Targeting Domain Admin

1. Attacker gains access to a junior IT technician's workstation via phishing.

2. Using Mimikatz, the attacker dumps cached credentials from LSASS memory.
3. A domain administrator account credential is found cached on the workstation.
4. The attacker uses the DA account to access the domain controller and deploys ransomware.

H O W PA M S T O P S T H E AT TA C K

Defence

• With PAM, the domain admin account has no standing password stored on workstations — it is vaulted
and only accessible via the PAM portal.
• Admin accounts only exist when a privileged session is actively requested (JIT) — there is no DA
account credential in memory to steal.
• Even if the attacker accesses the PAM portal, MFA and session approval workflows prevent
unauthorised access.
• All privileged session attempts are recorded and alerted to the SOC.

POPULAR VENDORS

CyberArk BeyondTrust Delinea (Thycotic)

Saviynt HashiCorp Vault One Identity

IDENTITY SECURITY

Identity Governance & Administration (IGA)

Who has access to what, and should they?

W H AT I T I S
IGA provides visibility and control over the identity lifecycle — ensuring that users have the right access
at the right time and that access rights are periodically reviewed and cleaned up. It addresses a
common problem: employees accumulate excessive permissions over time as they change roles, and
these orphaned permissions create significant risk.

C O R E C A PA B I L I T I E S

Access Certification — regular reviews where managers certify that their direct reports still need their
current access rights

Role Management — defining and governing role structures to prevent permission sprawl

Separation of Duties (SoD) — enforces that no single user has conflicting permissions (e.g., approving
and processing their own invoices)

Automated Provisioning/Deprovisioning — new joiners get correct access on day one; leavers lose all
access within hours of termination

POPULAR VENDORS

IBM Security Identity

SailPoint IdentityNow Saviynt
Governance

One Identity Manager Omada Identity

CHAPTER 04

Data Security
Data security technologies protect sensitive information throughout its lifecycle — at
rest, in transit, and in use. They prevent unauthorised access, accidental exposure, and
deliberate exfiltration of confidential data including PII, financial records, intellectual
property, and health information.

DATA SECURITY

DLP — Data Loss Prevention

Detect and prevent sensitive data from leaving controlled environments

W H AT I T I S

DLP monitors, detects, and blocks the movement of sensitive data — credit card numbers, Aadhaar
numbers, source code, patient records — across endpoints, networks, and cloud services. It uses
content inspection, context analysis, and policy enforcement to prevent both accidental exposure and
deliberate exfiltration.

D L P D E P LOY M E N T T Y P E S

Endpoint DLP — agent on the endpoint. Controls data copying to USB, printing, screenshots, and
uploads from the device.

Network DLP — inline or out-of-band on the network. Inspects email, web uploads, FTP, and cloud
sync traffic for sensitive content.

Cloud DLP (CASB-integrated) — scans data stored in cloud services (SharePoint, Google Drive,
Salesforce) for policy violations.

CONTENT DETECTION TECHNIQUES

Regular Expressions — matches known patterns like credit card numbers (16-digit), PAN numbers,
email addresses

Exact Data Matching (EDM) — fingerprints exact database records — if a specific customer's name +
card number appears in traffic, it is detected

Document Fingerprinting — creates a hash of sensitive documents — detects if their content is

embedded in outbound emails or uploads

Machine Learning Classification — classifies documents (financial reports, contracts, source code)
based on content patterns

T E C H N O LO GY E V O LU T I O N
 Basic Access Control
File system permissions and ACLs. No visibility into how data moves once accessed.

Encryption
Data encrypted at rest and in transit. Protects against physical theft and interception, but not against an authorised
user exfiltrating plaintext data.

Data Loss Prevention (DLP)

Active content inspection and blocking. Policy-based controls on data movement across endpoints, network, and
cloud.

Data Security Posture Management (DSPM)

Discovers where sensitive data lives across all cloud environments, classifies it, and identifies who has access —
providing continuous posture visibility beyond just blocking movement.

POPULAR VENDORS

Microsoft Purview DLP Symantec DLP (Broadcom) Forcepoint DLP

Zscaler DLP Netskope DLP Digital Guardian

DATA SECURITY

Encryption
Data at rest · In transit · In use

W H AT I T I S

Encryption transforms readable data (plaintext) into an unreadable ciphertext using a cryptographic
algorithm and a key. Only someone with the correct decryption key can convert the ciphertext back to
plaintext. Even if an attacker steals encrypted data, it is useless without the key.

E N C RY P T I O N I N T H R E E S TAT E S

Data at Rest — files on disk, database records, and backups are encrypted. Full-disk encryption
(BitLocker, FileVault) protects laptops if physically stolen. Database encryption protects records from
OS-level access.

Data in Transit — TLS (Transport Layer Security) encrypts all data moving across networks. HTTPS,
email encryption (TLS/S-MIME), and VPN tunnels are examples.

Data in Use — emerging technology (Confidential Computing, Intel SGX) encrypts data even while it is
being processed in memory — protecting it from hypervisor-level attacks in cloud environments.
KEY MANAGEMENT — THE CRITICAL ELEMENT

Encryption is only as strong as its key management. Common failures include: storing encryption keys
in the same location as encrypted data, using weak keys or deprecated algorithms (MD5, SHA-1, DES,
RC4), and not rotating keys after suspected compromise. Enterprise Key Management Systems (KMS)
— such as AWS KMS, HashiCorp Vault, or Thales CipherTrust — centralise, protect, and audit all
cryptographic keys.

DATA SECURITY

Tokenization
Replace sensitive data with non-sensitive tokens

W H AT I T I S

Tokenization replaces sensitive data (credit card numbers, Aadhaar numbers, bank account details)
with a randomly generated, non-sensitive placeholder called a token. The token has no mathematical
relationship to the original data — it cannot be reversed without access to the tokenisation vault that
holds the mapping. This is widely used in payment processing to reduce PCI-DSS scope.

T O K E N I Z AT I O N V S . E N C RY P T I O N

Aspect Encryption Tokenization

Reversibility Reversible with the key Only reversible via the vault

Data Format Changes length/format Can preserve format (same card number length)

Use Case Data in transit/at rest broadly Sensitive structured data (card numbers, SSNs)

Compliance Scope Reduces risk but data still in scope Removes data from compliance scope entirely

DATA SECURITY

Data Classification
Know what data you have before protecting it

W H AT I T I S

Data classification is the process of identifying, tagging, and categorising data based on its sensitivity
level and regulatory requirements. It is the foundation of all data security — you cannot protect what
you cannot find and categorise.

S TA N DA R D C L A S S I F I C AT I O N L E V E L S

Public — information intended for public consumption. No restrictions.

Internal / Internal Use Only — suitable for internal distribution. Not for public release.

Confidential — sensitive business information. Limited to specific roles. Requires encryption.

Restricted / Top Secret — highest sensitivity — PII, financial data, trade secrets. Strict access controls
and encryption mandatory.

POPULAR VENDORS

Microsoft Purview Varonis Spirion

BigID Titus (HelpSystems)

CHAPTER 05

Email Security
Over 90% of cyberattacks begin with a phishing email. Email is the highest-volume
attack vector in enterprise environments. Email security technologies operate at multiple
layers — from basic spam filtering to domain authentication and AI-based phishing
detection — to stop threats before they reach the user's inbox.

EMAIL SECURITY

Secure Email Gateway (SEG)

Inbound and outbound email inspection and filtering

W H AT I T I S

A Secure Email Gateway sits in front of an organisation's mail server (or cloud mail system) and
inspects all inbound and outbound emails for spam, malware, phishing, and data loss policy violations.
It is the primary email security control for most enterprises.

K E Y C A PA B I L I T I E S

Anti-Spam Engine — filters unsolicited bulk email using content analysis, sender reputation, and ML
models

Anti-Malware Scanning — inspects email attachments against AV signatures and sandboxing

URL Rewriting & Click-Time Protection — all links are rewritten through a proxy. When a user clicks,
the URL is evaluated at click-time against real-time threat feeds — protecting against URLs that become
malicious after delivery

Attachment Sandboxing — suspicious attachments are detonated in a sandbox before delivery

DLP for Outbound Email — scans outbound messages for sensitive data (card numbers, PII, financial
data)

Email Authentication Enforcement — validates DMARC, DKIM, SPF on inbound emails

H O W I T W O R K S — S T E P - BY- S T E P

INBOUND EMAIL PROCESSING

1 Inbound email arrives at the gateway's MX record endpoint.

↓
2 Sender reputation check — is the sending IP/domain on known spam or malicious sender lists?

↓
 3 Email authentication — SPF, DKIM, and DMARC records are verified. Failing emails are
quarantined or rejected per policy.

↓
4 Header and content analysis — checks for phishing indicators, impersonation patterns, urgency
language, suspicious links.

↓
5 Attachments are extracted and scanned. Unknown files are submitted to the sandbox for
detonation.

↓
6 All URLs are rewritten through a time-of-click proxy.

↓
7 Clean email is delivered. Suspicious email is quarantined for review. Confirmed malicious email
is blocked and logged.

POPULAR VENDORS

Proofpoint Email Security Mimecast Barracuda Email Security

Microsoft Defender for Office

Cisco Email Security (ESA) Abnormal Security
365

EMAIL AUTHENTICATION

SPF, DKIM & DMARC

The three-layer email domain authentication framework

SPF — SENDER POLICY FRAMEWORK

SPF is a DNS record that declares which mail servers are authorised to send email on behalf of a
domain. When a receiving mail server gets an email claiming to be from [Link] , it queries the
SPF record in DNS to check if the sending server's IP address is in the authorised list. If not, the email
fails SPF.

What it prevents: IP-based email spoofing — attackers sending email from unauthorised servers while
forging the From domain.

Limitation: SPF only checks the envelope sender (the Return-Path header). It does not check the
visible From address, which is what the user sees. Attackers can pass SPF while still spoofing the
display name.

D K I M — D O M A I N K E YS I D E N T I F I E D M A I L

DKIM adds a cryptographic digital signature to every outbound email. The sending mail server signs
the email headers and body with a private key. The corresponding public key is published in a DNS TXT
record. The receiving server retrieves this public key and verifies the signature — confirming that the
email was sent by the domain and has not been tampered with in transit.

What it prevents: Email tampering and forgery. Proves the email originated from the domain's
authorised infrastructure and was not modified after signing.

D M A R C — D O M A I N - B A S E D M E S S A G E A U T H E N T I C AT I O N , R E P O R T I N G A N D C O N FO R M A N C E

DMARC ties SPF and DKIM together and gives domain owners control over what happens when emails
fail both checks. It is published as a DNS TXT record and specifies a policy ( none , quarantine , or
reject ) and a reporting address for receiving failure reports.

p=none — monitoring mode. No action taken on failures. Aggregate reports sent to the owner.

p=quarantine — failing emails are sent to the spam/junk folder.

p=reject — failing emails are rejected at the gateway and not delivered. Strongest protection against
spoofing.

HOW THEY WORK TOGETHER

AUTHENTICATION CHAIN

1 Email arrives at the receiving mail server.

↓
2 SPF check: does the sending IP appear in the domain's SPF DNS record?

↓
3 DKIM check: is the DKIM signature in the email header valid using the public key in DNS?

↓
4 DMARC alignment check: does the domain in the From header align with the domain that
passed SPF or DKIM?

↓
5 If both SPF and DKIM fail, the DMARC policy is applied: none, quarantine, or reject.

↓
6 DMARC aggregate reports are sent to the domain owner's reporting address — showing all
senders claiming to use the domain.

R E A L- W O R L D S C E N A R I O
Scenario — Business Email Compromise (BEC)

Attacker sends an email to the finance team appearing to come from the CEO ( ceo@[Link] ),
requesting an urgent wire transfer. The email is sent from a malicious server with no relationship to
[Link]. Without DMARC, this email may pass basic spam filters and be delivered to the finance
employee.

Defence with DMARC p=reject

The receiving mail server checks SPF — the sending IP is not in [Link]'s SPF record. DKIM
signature is absent. DMARC alignment fails on both checks. With p=reject , the email is blocked at
the gateway and never reaches the finance team's inbox.
CHAPTER 06

Cloud Security
Cloud environments introduce new attack surfaces: misconfigured storage buckets, over-
permissioned IAM roles, unsanctioned SaaS applications, and workloads running with
unpatched vulnerabilities. Cloud security technologies provide visibility, control, and
threat detection specifically designed for cloud infrastructure and services.

CLOUD SECURITY

CASB — Cloud Access Security Broker

Security control point between users and cloud services

W H AT I T I S

A CASB sits between users and cloud services, providing visibility into cloud app usage, enforcing
security policies, detecting threats, and preventing data loss. It solves the "Shadow IT" problem —
employees using unsanctioned cloud services that IT has no visibility into — and provides security
controls for both sanctioned and unsanctioned cloud applications.

C A S B FO U R P I L L A R S

Visibility — discovers all cloud apps used by employees. Identifies sanctioned vs. unsanctioned
(shadow IT) apps.

Data Security — applies DLP policies to data stored in and transferred to cloud services. Prevents
sensitive data from being uploaded to personal Dropbox, for example.

Threat Protection — detects compromised accounts, insider threats, and malware spread through
cloud storage.

Compliance — maps cloud data handling to regulatory frameworks (GDPR, HIPAA, PCI-DSS) and
generates compliance reports.

C A S B D E P LOY M E N T M O D E S

API Mode — connects directly to cloud app APIs (Office 365, Salesforce). Can scan existing data at
rest, audit configurations, and detect past incidents. No inline traffic required.

Proxy Mode (Forward) — all traffic from users to cloud apps is routed through the CASB proxy. Real-
time inspection and blocking.

Proxy Mode (Reverse) — deployed in front of specific cloud apps. Controls access from unmanaged
devices without a client agent.

POPULAR VENDORS
 Microsoft Defender for Cloud
Netskope Zscaler CASB
Apps

Palo Alto Prisma SaaS Forcepoint CASB Skyhigh Security

CLOUD SECURITY

CSPM — Cloud Security Posture Management

Continuous misconfiguration detection across cloud infrastructure

W H AT I T I S

CSPM continuously monitors cloud infrastructure (AWS, Azure, GCP) for security misconfigurations,
policy violations, and compliance gaps. The majority of cloud breaches are caused by misconfiguration
— an S3 bucket left public, an overly permissive IAM role, security groups with [Link]/0 rules. CSPM
identifies these issues before attackers do.

W H AT C S P M M O N I T O R S

Storage: Public S3 buckets, blob containers with no access controls

Networking: Security groups/NSGs with unrestricted inbound access on sensitive ports

IAM: Overly permissive roles, root account usage, accounts without MFA

Encryption: Unencrypted databases, storage volumes, snapshots

Logging: CloudTrail/Activity Log not enabled, log retention too short

Compliance: Maps findings to frameworks — CIS Benchmarks, NIST, ISO 27001, RBI, CERT-In

HOW IT WORKS

CSPM CONTINUOUS ASSESSMENT

1 CSPM connects to cloud accounts via read-only API credentials (AWS Config, Azure Policy, GCP
Security Command Center).

↓
2 Cloud resource configurations are continuously inventoried — instances, databases, storage,
IAM policies, network rules.

↓
3 Each resource is evaluated against a security rules library — thousands of checks based on CIS
Benchmarks, vendor security best practices, and regulatory requirements.
 ↓
4 Violations are prioritised by severity and risk context — a public S3 bucket containing PII is
higher priority than one containing public marketing assets.

↓
5 Findings are surfaced to the security team with remediation guidance. Some platforms offer
one-click or automated remediation.

POPULAR VENDORS

Palo Alto Prisma Cloud Wiz Orca Security

Lacework Check Point CloudGuard Tenable Cloud Security

AWS Security Hub

CLOUD SECURITY

CWPP — Cloud Workload Protection Platform

Runtime protection for VMs, containers, and serverless functions

W H AT I T I S

CWPP provides security visibility and protection for cloud workloads — virtual machines, containers,
Kubernetes clusters, and serverless functions — wherever they run. While CSPM checks configuration,
CWPP protects the workloads themselves at runtime, detecting threats inside them as they execute.

K E Y C A PA B I L I T I E S

Vulnerability Assessment — scans running workloads for OS and package vulnerabilities

Runtime Threat Detection — detects suspicious process behaviour, privilege escalation, crypto mining
inside containers and VMs

Network Micro-Segmentation — enforces allowed communication paths between workloads

Container Image Scanning — scans Docker images and registries for vulnerabilities before deployment

Host Intrusion Detection — monitors system calls and file integrity on cloud instances

POPULAR VENDORS

Palo Alto Prisma Cloud Wiz Aqua Security

Sysdig Lacework Trend Micro Cloud One
CHAPTER 07

Application Security
Applications — web apps, APIs, mobile apps, and internally developed software — are a
primary attack surface. Application security technologies protect applications from
exploitation by detecting and blocking attacks at runtime, identifying vulnerabilities in
code and dependencies before deployment, and securing the software supply chain.

APPLICATION SECURITY

WAF — Web Application Firewall

HTTP/HTTPS traffic inspection and application-layer attack prevention

W H AT I T I S

A WAF inspects HTTP and HTTPS traffic to and from a web application and blocks application-layer
attacks — SQL injection, cross-site scripting (XSS), CSRF, directory traversal, and other OWASP Top 10
vulnerabilities. It operates at Layer 7 of the OSI model, understanding application-specific protocols
and attack patterns that network firewalls cannot detect.

WHY IT EXISTS

A network firewall permits port 443 (HTTPS) traffic to a web application. A SQL injection attack arrives
as perfectly valid HTTPS traffic — the firewall has no reason to block it. The WAF sits in front of the
application and can inspect the actual HTTP request payload to identify injection patterns, malformed
requests, and known attack signatures.

W A F O P E R AT I N G M O D E S

Negative Security Model (Blacklist) — blocks known attack patterns. Fast to deploy but may miss novel
attacks.

Positive Security Model (Whitelist) — defines what valid requests look like and blocks everything else.
Stronger protection but requires significant tuning time.

Hybrid Mode — combines both models with ML-based anomaly detection. Most enterprise WAFs use
this approach.

T E C H N O LO GY E V O LU T I O N

Basic Firewall
Blocked ports and IPs only. No visibility into application layer traffic. SQL injection over port 443 was completely
invisible.
 Web Application Firewall (WAF)
Signature-based Layer 7 inspection. Blocked OWASP Top 10 attacks. Deployed as on-prem appliances or reverse
proxies.

Cloud WAF / CDN-integrated WAF

WAF delivered via CDN (Cloudflare, AWS CloudFront). Scales automatically. Added bot management and DDoS
mitigation.

WAAP — Web Application and API Protection

Extends WAF to cover API security, bot management, DDoS protection, and account takeover prevention in a single
platform.

POPULAR VENDORS

Cloudflare WAF AWS WAF Imperva WAF

F5 Advanced WAF Akamai App & API Protector Barracuda WAF

APPLICATION SECURITY

API Security
Protecting REST, GraphQL, and gRPC APIs from abuse and attack

W H AT I T I S

API Security protects the machine-to-machine interfaces that power modern applications. APIs handle
authentication, data retrieval, and business logic — and are increasingly the primary attack surface for
data breaches. API-specific attacks include broken object-level authorisation (BOLA), excessive data
exposure, mass assignment, and API key theft.

W H Y A P I S N E E D D E D I C AT E D S E C U R I T Y

Traditional WAFs were designed for HTML-based web apps. APIs communicate in JSON/XML, use
REST or GraphQL endpoints, and have complex authorisation logic. A WAF rule blocking SELECT *
FROM in a URL query string is irrelevant when an attacker is exploiting a BOLA vulnerability by changing

a numeric ID in a REST API call body to access another user's data — valid JSON, no SQL injection
present.

K E Y C A PA B I L I T I E S
 API Discovery — automatically discovers all APIs in use — including shadow APIs (undocumented,
forgotten endpoints)

Schema Validation — enforces that API requests match the expected structure defined in
OpenAPI/Swagger specifications

Authentication & Authorisation Enforcement — ensures every API call is authenticated and the caller
is authorised to access the requested resource

Rate Limiting & Abuse Protection — prevents credential stuffing, data scraping, and enumeration
attacks

Behavioural Analytics — detects unusual API usage patterns that may indicate compromised API keys
or insider threats

POPULAR VENDORS

Salt Security Noname Security Traceable AI

Imperva API Security F5 NGINX + API Security Cloudflare API Shield

APPLICATION SECURITY

Container Security
Securing Docker, Kubernetes, and container registries

W H AT I T I S

Container security addresses the unique risks of containerised environments — vulnerable base
images, over-privileged containers, misconfigured Kubernetes RBAC, and runtime attacks within
containers. It covers security across the full container lifecycle: build, ship, and run.

C O N TA I N E R S E C U R I T Y L AY E R S

Image Scanning — scans Docker images for known CVEs in OS packages and application dependencies
before pushing to a registry or deploying to production

Registry Security — enforces that only scanned, signed, and approved images can be pulled and
deployed

Kubernetes Configuration Security — identifies RBAC misconfigurations, privileged pods, containers

running as root, missing network policies

Runtime Protection — detects anomalous behaviour inside running containers — unexpected

processes, privilege escalation attempts, unusual outbound connections
 Network Policies — enforces which pods can communicate with which other pods and external
services

POPULAR VENDORS

Aqua Security Sysdig Secure Prisma Cloud (Palo Alto)

Snyk Container Wiz Lacework

APPLICATION SECURITY

DevSecOps & Software Composition Analysis (SCA)

Security embedded in the development pipeline

W H AT I T I S

DevSecOps integrates security testing and controls directly into the software development lifecycle
(CI/CD pipeline), shifting security left — catching vulnerabilities in code and dependencies during
development rather than finding them in production. The goal is to make security a continuous,
automated part of the build process.

KEY DEVSECOPS TOOLS

SAST (Static Application Security Testing) — analyses source code for security vulnerabilities without
running it. Catches SQL injection, XSS, hardcoded credentials in the codebase.

DAST (Dynamic Application Security Testing) — tests a running application by simulating attacks from
the outside. Finds runtime vulnerabilities that SAST misses.

SCA (Software Composition Analysis) — scans open-source dependencies and third-party libraries for
known CVEs. Critical given that 80%+ of modern application code comes from open-source packages
(Log4j, Spring, OpenSSL).

Secrets Scanning — detects API keys, tokens, and passwords accidentally committed to source code
repositories.

IaC Security — scans Infrastructure-as-Code files (Terraform, CloudFormation) for misconfigurations

before infrastructure is deployed.

POPULAR VENDORS

Snyk Veracode Checkmarx

SonarQube GitHub Advanced Security Semgrep

Black Duck (Synopsys)

CHAPTER 08

Vulnerability Management
Vulnerability management is the continuous process of identifying, classifying,
prioritising, and remediating security weaknesses across an organisation's technology
assets. An unpatched vulnerability is one of the most common ways attackers gain initial
access to environments.

VULNERABILITY MANAGEMENT

Vulnerability Scanners
Automated discovery of known security weaknesses

W H AT I T I S

Vulnerability scanners probe hosts, applications, and network devices to detect known security
vulnerabilities — missing patches, weak configurations, open services with known exploits. They
compare findings against the CVE (Common Vulnerabilities and Exposures) database and vendor-
specific advisories to identify which specific vulnerabilities are present.

SCAN TYPES

Unauthenticated Scan (External) — simulates an external attacker perspective. Identifies externally

visible services, open ports, and vulnerabilities detectable without credentials.

Authenticated Scan (Internal) — uses credentials to log into each host and inspect installed software
versions, patch levels, configuration settings. Far more thorough and accurate.

Agent-Based Scan — a lightweight agent installed on endpoints continuously reports vulnerability

status to the central platform. No network scan required. Better for laptops and remote devices.

VULNERABILITY SCORING — CVSS

Vulnerabilities are scored using CVSS (Common Vulnerability Scoring System) on a 0–10 scale:

Critical: 9.0–10.0 — Patch immediately

High: 7.0–8.9 — Patch within 72 hours or one week

Medium: 4.0–6.9 — Patch within 30 days

Low: 0.1–3.9 — Schedule for next maintenance window

CVSS alone is insufficient for prioritisation. A Critical CVE on an isolated internal test server with no
internet exposure is less urgent than a High CVE on an internet-facing login portal. Risk-based
 vulnerability management tools ([Link], Qualys VMDR) combine CVSS with asset criticality,
exposure context, and active exploitation data to produce a prioritised remediation list.

POPULAR VENDORS

Tenable Nessus / [Link] Qualys VMDR Rapid7 InsightVM

Microsoft Defender
OpenVAS (open-source)
Vulnerability Management

VULNERABILITY MANAGEMENT

Patch Management
Systematic deployment of security patches across the estate

W H AT I T I S

Patch management is the process of acquiring, testing, and deploying software updates (patches) to fix
security vulnerabilities and bugs across an organisation's systems — operating systems, applications,
firmware, and middleware. Unpatched systems are one of the most commonly exploited attack vectors
in enterprise breaches.

PAT C H M A N A G E M E N T L I F E C YC L E

PATCH MANAGEMENT PROCESS

1 Inventory — maintain a complete, accurate asset inventory. You cannot patch what you don't
know exists.

↓
2 Monitor — subscribe to vendor security advisories (Microsoft Patch Tuesday, CVE feeds, CERT-
In advisories).

↓
3 Prioritise — combine CVSS score, asset criticality, and exploitation context to determine patch
order.

↓
4 Test — deploy patches to a test environment first to check for compatibility issues before
production rollout.

↓
 5 Deploy — push patches via management tools (WSUS, SCCM, Ansible) using change
management procedures.

↓
6 Verify — re-scan patched systems to confirm the vulnerability is closed.

POPULAR VENDORS

ManageEngine Patch Manager

Microsoft WSUS / Intune Ivanti Patch Management
Plus

Qualys Patch Management Automox

VULNERABILITY MANAGEMENT

Attack Surface Management (ASM)

See your organisation the way an attacker does

W H AT I T I S

Attack Surface Management continuously discovers, inventories, and monitors all of an organisation's
internet-facing assets — domains, IP ranges, cloud services, certificates, web applications, and APIs —
including unknown and forgotten assets. It provides the attacker's-eye view of the organisation's
external exposure.

WHY IT EXISTS

Organisations routinely have hundreds of unknown external assets — forgotten servers from
acquisitions, development environments accidentally left exposed, shadow IT cloud instances.
Attackers use OSINT and scanning tools to find these before the security team does. ASM automates
the continuous discovery of these assets so the organisation knows its full external footprint.

POPULAR VENDORS

Mandiant Attack Surface

CrowdStrike Falcon Surface Tenable ASM
Management

Microsoft Defender EASM Censys Cycognito

CHAPTER 09

Security Operations (SOC)

Security Operations technologies provide the visibility, intelligence, and automation that
a SOC needs to detect, investigate, and respond to threats across the entire
environment. They collect data from every security tool, correlate it into meaningful
alerts, and increasingly automate the response — compressing the time between
detection and containment.

SECURITY OPERATIONS

SIEM — Security Information & Event Management

Central log aggregation, correlation, and alert generation

W H AT I T I S

A SIEM collects log and event data from every source in the environment — firewalls, endpoints,
identity systems, cloud platforms, applications — and correlates events from across these disparate
sources to detect attack patterns that no single tool could identify alone. It is the central nervous
system of the SOC.

WHY IT EXISTS

Individual security tools generate thousands of events per day. No analyst can review firewall logs, EDR
alerts, authentication logs, and cloud audit trails manually across dozens of systems. The SIEM
aggregates all this data, normalises it into a common format, applies correlation rules, and surfaces
high-fidelity alerts — so the analyst sees a single merged alert saying "user X received a phishing email,
downloaded a file, and PowerShell made an outbound network call" rather than three separate
unconnected events in three different consoles.

KEY COMPONENTS

Log Collectors / Forwarders — agents or syslog receivers that collect and forward events from every
source

Data Normalisation Engine — parses logs from different formats (CEF, LEEF, JSON, syslog) into a
common data model

Correlation Engine — applies rules that match patterns across multiple events, sources, and
timeframes

Threat Intelligence Integration — enriches events with IOC context — is this IP known bad? Is this file
hash in a threat feed?

Alert Management — prioritises and routes alerts to analysts with full context
 Search & Investigation — allows analysts to query historical data during incident investigations

Dashboards & Reporting — real-time SOC visibility and compliance reporting

H O W I T W O R K S — S T E P - BY- S T E P

SIEM DETECTION WORKFLOW

1 Log sources forward events to the SIEM — EDR, firewall, Active Directory, email gateway, cloud
audit logs, VPN.

↓
2 The normalisation engine parses each log format and maps fields to the common data model
(user, IP, action, timestamp, resource).

↓
3 Events are enriched with threat intelligence — IP reputation, domain age, file hash lookups.

↓
4 Correlation rules execute — e.g., "if a user fails authentication 10 times within 5 minutes
followed by a successful login from a new country, generate a high-severity alert."

↓
5 Alert is generated with full context — user, timeline, source IPs, related events, threat
intelligence hits, MITRE ATT&CK technique references.

↓
6 Alert is queued for analyst review. Analyst investigates by pivoting through historical events in
the SIEM search console.

↓
7 Confirmed incident is escalated, and the SIEM triggers a SOAR playbook for automated
response.

T E C H N O LO GY E V O LU T I O N

Log Management
Basic syslog collection. No correlation. Analysts manually searched logs to investigate incidents. Extremely time-
intensive.

SIEM
Added correlation rules, alerting, and dashboards. Became the central SOC platform. Challenge: very high false
positive rates from signature-based correlation rules.

SIEM + SOAR
Added automated playbook execution. Analyst time shifted from manual triage to high-priority investigations.

SIEM + UEBA + ML
 Behavioural baselines replaced many signature-based rules. Reduced false positives. Detected insider threats and
compromised accounts that rules missed.

Next-Gen SIEM / XDR + Autonomous SOC

AI-driven alert triage and investigation. Some platforms can auto-close false positives and auto-contain threats.
Analysts focus on novel threats and strategic decisions.

POPULAR VENDORS

Splunk Enterprise Security Microsoft Sentinel IBM QRadar

Elastic Security Exabeam LogRhythm

Securonix

SECURITY OPERATIONS

SOAR — Security Orchestration, Automation & Response

Automated playbooks for incident response and triage

W H AT I T I S

SOAR automates repetitive and time-sensitive security operations tasks by orchestrating actions
across multiple security tools via APIs. When a SIEM alert fires, SOAR can automatically enrich it with
threat intelligence, query the EDR for process details, check if the user's account has been
compromised, block the malicious IP on the firewall, isolate the endpoint, and notify the analyst — all
within seconds, without human intervention.

WHY IT EXISTS

SOC analysts are overwhelmed — tier-1 analysts spend the majority of their time on repetitive, low-
judgment tasks: looking up IPs in threat intel databases, checking if a file hash is known malicious,
querying Active Directory for user details. SOAR eliminates this toil, allowing analysts to focus on
complex investigations while automated playbooks handle routine tasks faster and more consistently
than humans can.

KEY CONCEPTS

Playbook — a defined workflow of automated actions triggered by specific alert types. Written visually
(drag-and-drop) or in code.
 Integrations / Connectors — pre-built API connectors to hundreds of security tools — firewalls, EDR,
SIEM, ticketing systems, email gateways

Case Management — incident cases with full audit trail of automated and manual actions

Orchestration — executing actions across multiple tools in a coordinated sequence

E X A M P L E S O A R P L AY B O O K — P H I S H I N G R E S P O N S E

AUTOMATED PHISHING RESPONSE PLAYBOOK

1 SIEM alerts: user clicked a malicious link in a phishing email.

↓
2 SOAR automatically queries the email gateway API — extract the original email, all recipients,
sender details, and attachment hashes.

↓
3 URL reputation check — submit the clicked URL to VirusTotal, Cisco Talos, and the internal
threat intel platform.

↓
4 EDR query — was any file downloaded or executed on the user's endpoint after the click?

↓
5 If confirmed malicious: automatically delete the phishing email from all recipient mailboxes,
block the URL on the SWG, isolate the endpoint via EDR API.

↓
6 Create a ticket in the ITSM system (ServiceNow) with all evidence. Notify the analyst and user's
manager with a summary.

↓
7 If no malicious activity confirmed: auto-close the case, add to analyst review queue as
informational.

POPULAR VENDORS

Splunk SOAR (Phantom) Palo Alto XSOAR Microsoft Sentinel Automation

IBM Security SOAR Swimlane Tines

SECURITY OPERATIONS
UEBA — User & Entity Behaviour Analytics
Detecting insider threats and compromised accounts through behavioural baselines

W H AT I T I S

UEBA analyses the behaviour of users, devices, and applications over time to build normal behavioural
baselines for each entity. It detects deviations that may indicate insider threats, account compromise,
or privilege abuse — without relying on known signatures or rules.

W H AT U E B A D E T E C T S

Compromised Accounts — a user who normally works 9–5 in Mumbai suddenly authenticates at 2 AM
from Eastern Europe

Insider Threats — an employee accessing 10x their normal volume of sensitive documents the week
before their resignation date

Lateral Movement — a service account that has never accessed the HR server suddenly querying
payroll databases

Data Exfiltration — a user downloading 10 GB of files from SharePoint and uploading to a personal
Dropbox in the same session

HOW IT WORKS

UEBA uses machine learning to model normal behaviour for every user and entity — login times, data
access volumes, application usage, peer group comparison. It assigns a dynamic risk score that
increases as anomalous behaviours accumulate. A single unusual event may not trigger an alert, but a
combination of anomalies (unusual login time + unusual data access + unusual destination)
compounds the risk score to a threshold that triggers investigation.

POPULAR VENDORS

Splunk UBA Exabeam UEBA Microsoft Sentinel UEBA

Securonix UEBA Varonis DatAdvantage

CHAPTER 10

Threat Intelligence
Threat intelligence transforms raw data about threats into actionable knowledge that
helps security teams make better decisions — about what to prioritise, what attacks to
expect, and what indicators to look for in their environment. It shifts security posture
from reactive to proactive.

THREAT INTELLIGENCE

Threat Intelligence Platform (TIP)

Aggregate, enrich, analyse, and operationalise threat intelligence

W H AT I T I S

A Threat Intelligence Platform aggregates intelligence from multiple sources — commercial feeds,
open-source feeds (OSINT), ISACs, government advisories (CERT-In, US-CERT), and internal
observations — normalises it, removes duplicates and false positives, enriches indicators with context,
and distributes actionable intelligence to security controls and analysts.

T Y P E S O F T H R E AT I N T E L L I G E N C E

Strategic Intelligence — high-level trends and actor motivations. Intended for executives and security
leadership. Example: "Nation-state actors are targeting Indian financial sector infrastructure through
supply chain attacks."

Operational Intelligence — details about specific upcoming or ongoing campaigns. Useful for security
architects and IR teams.

Tactical Intelligence — TTPs (Tactics, Techniques, and Procedures) of specific threat actors. Mapped to
MITRE ATT&CK. Used by SOC and red teams.

Technical Intelligence — specific IOCs — malicious IPs, domains, file hashes, URLs, email senders.
Directly ingested by SIEM, firewall, EDR, and email gateway.

I N T E L L I G E N C E L I F E C YC L E

INTELLIGENCE LIFECYCLE

1 Direction — define intelligence requirements. What threats are most relevant to our industry
and region?

↓
2 Collection — gather data from feeds, dark web monitoring, honeypots, partner sharing, and
internal telemetry.
 ↓
3 Processing — normalise, deduplicate, and enrich collected data. Remove false positives and
stale indicators.

↓
4 Analysis — correlate indicators, identify campaigns, attribute to threat actors, assess relevance
to the organisation.

↓
5 Dissemination — push IOCs to SIEM/EDR/firewall. Brief security leadership on strategic
threats. Share with industry peers via ISACs.

↓
6 Feedback — measure effectiveness. Did the IOCs result in detections? Update requirements
accordingly.

K E Y FO R M AT S

STIX (Structured Threat Information eXpression) — standardised format for describing threat
intelligence

TAXII (Trusted Automated eXchange of Indicator Information) — protocol for sharing STIX data
between organisations and platforms

MISP (Malware Information Sharing Platform) — open-source TIP widely used for community
intelligence sharing

POPULAR VENDORS

Recorded Future ThreatConnect Anomali ThreatStream

MISP (open-source) Palo Alto Unit 42 TIM CrowdStrike Falcon Intelligence

CHAPTER 11

Modern Security Architecture

Individual security technologies provide point protections. But a modern enterprise
security architecture requires these tools to work together as an integrated system —
providing layered defence, shared visibility, and coordinated response across every
domain.

ARCHITECTURE PRINCIPLE

Zero Trust Architecture

"Never trust, always verify"

W H AT I T I S

Zero Trust is a security model that eliminates implicit trust based on network location. In a traditional
perimeter security model, anything inside the corporate network was trusted. Zero Trust assumes
breach — no user, device, or workload is trusted by default, regardless of whether it is inside or outside
the network perimeter. Every access request must be explicitly verified.

CORE ZERO TRUST PRINCIPLES

Verify Explicitly — authenticate and authorise every request based on all available data points: identity,
location, device health, service, workload, and data classification.

Use Least Privilege Access — limit user and system access with just-in-time and just-enough-access
(JIT/JEA) policies. Minimise lateral movement risk.

Assume Breach — design controls assuming the network is already compromised. Minimise blast
radius through micro-segmentation and encryption.

ZERO TRUST PILL ARS

Pillar What It Secures Key Technologies

Identity User and service accounts IAM, MFA, PAM, UEBA

Devices Endpoints and workstations EDR, MDM, Device Compliance Policies

Network Network access and traffic ZTNA, Micro-segmentation, NDR

Applications App access and usage WAF, API Security, CASB

Data Sensitive data assets DLP, Encryption, Data Classification

 Pillar What It Secures Key Technologies

Infrastructure Servers, cloud, containers CSPM, CWPP, Vulnerability Management

Visibility Threats and anomalies SIEM, XDR, Threat Intelligence

ARCHITECTURE PRINCIPLE

Defence in Depth
Layered security controls — no single point of failure

W H AT I T I S

Defence in Depth is the principle of deploying multiple, overlapping layers of security controls so that if
one control fails or is bypassed, others remain to detect and stop the attack. No single security product
provides complete protection — the combination of layered controls is what makes an environment
resilient.

E X A M P L E — P H I S H I N G AT TA C K T H R O U G H D E F E N C E I N D E P T H

Layer Control What It Does

Email Secure Email Gateway + Blocks most phishing emails at delivery

DMARC

Browser Secure Web Gateway (URL Blocks phishing site if the link is clicked
filtering)

Endpoint NGAV + EDR Blocks and detects malicious file execution

Network Firewall + NDR Blocks C2 communication from malware

Identity MFA Prevents credential use even if stolen

Data DLP + Encryption Prevents data exfiltration even if attacker gains access

Operations SIEM + SOAR Detects, correlates, and responds to any events that pass
through
 SECURITY OPERATIONS

SOC Detection & Response Lifecycle

From initial detection to full containment and recovery

T H E N I S T I N C I D E N T R E S P O N S E L I F E C YC L E

The NIST SP 800-61 framework defines four phases of incident response that every SOC workflow
follows:

Preparation — tooling, playbooks, team training, and communication plans are in place before an
incident occurs

Detection & Analysis — alerts are generated, triaged, and investigated to confirm a true positive
incident

Containment, Eradication & Recovery — the threat is isolated, malicious artefacts are removed, and
systems are restored

Post-Incident Activity — lessons learned, detection rule improvements, control gap remediation

T Y P I C A L S O C A L E R T T R I A G E W O R K F LO W

ALERT TRIAGE & INVESTIGATION

1 Alert Received — SIEM generates an alert. SOAR auto-enriches it with threat intel, EDR data,
and identity context.

↓
2 Tier-1 Triage — L1 analyst reviews the enriched alert. Is it a true positive or false positive?
Basic investigation: affected users, systems, scope.

↓
3 Escalation — confirmed true positive escalated to L2/L3. Full forensic investigation: attack
timeline, root cause, patient zero, full scope of compromise.

↓
4 Containment — isolate affected endpoints via EDR. Block IOCs (IPs, hashes, domains) on
firewall, email gateway, and DNS. Revoke compromised credentials.

↓
5 Eradication — remove malware, close attack vectors, patch the exploited vulnerability, audit for
persistence mechanisms.

↓
6 Recovery — restore systems from clean backups. Monitor closely for re-infection. Return to
normal operations.

↓
7 Lessons Learned — post-incident review. New detection rules added to SIEM. Control gaps
addressed. Playbooks updated.
REFERENCE

Technology Comparisons
Side-by-side comparisons of commonly confused or overlapping cybersecurity
technologies. Understanding the distinctions helps in selecting the right tool for the right
problem.

Firewall vs. IDS vs. IPS

Capability Firewall IDS IPS

Blocks traffic Yes No Yes

Deployed inline Yes No (SPAN port) Yes

Application-layer NGFW only Yes Yes

inspection

Signature-based NGFW only Yes Yes

detection

Generates alerts Limited Primary function Yes

Risk if misconfigured Blocks legitimate traffic None (passive) Blocks legitimate traffic

Best use case Perimeter enforcement, Visibility without risk Active prevention of
policy control of blocking known attacks

Antivirus vs. NGAV vs. EDR

Capability Traditional AV NGAV EDR

Signature-based detection Yes (primary) Partial Supplementary

Zero-day detection No Yes (ML) Yes (behaviour)

Fileless attack detection No Limited Yes

Continuous endpoint recording No No Yes

 Capability Traditional AV NGAV EDR

Threat hunting No No Yes

Incident investigation No Minimal Yes (process tree, timeline)

Remote response actions No No Yes (isolate, kill, quarantine)

SIEM vs. SOAR

Dimension SIEM SOAR

Primary Function Collect, correlate, alert on log data Automate and orchestrate incident response

Input Logs and events from all security Alerts from SIEM and security tools
tools

Output Correlated alerts, dashboards, Automated response actions, case

reports management

Human Analysts review and investigate Automates analyst tasks; humans handle edge
Interaction alerts cases

Response Speed As fast as analyst can investigate Seconds (automated)

Together SIEM detects → SOAR responds. Used together in modern SOCs.

VPN vs. ZTNA

Dimension VPN ZTNA

Access Scope Full network access once connected Per-application access only

Trust Model Trust once authenticated Continuous verification per session

Lateral Movement Risk High — attacker pivots freely once on Low — network never exposed
VPN
 Dimension VPN ZTNA

Device Posture Optional, rarely enforced Continuous, mandatory

Checking

Performance Routes all traffic to HQ then back out Direct-to-application path

optimisation

Cloud App Support Poor (backhauling traffic) Native (traffic goes directly to SaaS)

Recommended For Legacy environments, site-to-site Remote users, cloud-first

organisations

CASB vs. SASE vs. SSE

Dimension CASB SSE SASE

Scope Cloud applications Cloud apps + web + private SSE + WAN/SD-WAN

only apps

Includes SWG No Yes Yes

Includes ZTNA No Yes Yes

Includes SD- No No Yes

WAN

Best For SaaS data control Security for cloud-first remote Full network + security
workforce transformation

DLP vs. Encryption

Dimension DLP Encryption

Protection Against Accidental/deliberate data movement by Unauthorised access to data at

authorised users rest/in transit

Blocks Insiders Yes No (authorised users can read

encrypted data)
Dimension DLP Encryption

Protects Stolen No Yes (full disk encryption)

Devices

Requires Content Yes No

Inspection

Together Complementary: DLP prevents movement, encryption protects data if DLP is

bypassed.
FINAL SECTION

How Modern Security Stacks Work

Together
A security tool deployed in isolation provides limited value. The power of a modern
security architecture comes from integration — tools sharing context, telemetry, and
response capabilities so that a detection in one domain triggers coordinated action
across the entire stack.

E N T E R P R I S E S E C U R I T Y S TA C K O V E RV I E W

USER Employee / Contractor / Partner

↓ Every request verified (Zero Trust)

IDENTITY IAM + MFA + PAM Okta / Entra ID / CyberArk

↓ Authenticated session

ENDPOINT NGAV + EDR CrowdStrike / SentinelOne

↓ Traffic leaving the device

NETWORK ZTNA / SASE + SWG + NDR Zscaler / Palo Alto / Darktrace

↓ Reaching the application

APPLICATION WAF + API Security + CASB Cloudflare / Salt / Netskope

↓ Accessing data

DATA DLP + Encryption + Classification Microsoft Purview / Forcepoint

↓ All telemetry flows to

CLOUD CSPM + CWPP Wiz / Prisma Cloud

↓ All events centralised

SIEM + SOAR + Threat Splunk / Microsoft Sentinel / Palo

OPERATIONS
Intelligence + UEBA Alto XSOAR

C O M P L E T E D E T E C T I O N & R E S P O N S E W O R K F LO W
Here is how a full attack detection and response scenario plays out in a mature enterprise security
stack:

Scenario — Advanced Persistent Threat: Initial Access via Phishing → Lateral Movement → Data
Exfiltration

An attacker sends a spear-phishing email to a finance analyst containing a macro-enabled Excel file.
The attacker's goal is to reach the payroll database.

INTEGRATED DETECTION & RESPONSE — STEP BY STEP

1 Email Layer (SEG + DMARC) — The phishing email arrives. DMARC alignment check: the sender
domain fails SPF. With p=reject, the email is blocked. If a zero-day lure bypasses the gateway,
the URL is rewritten for time-of-click scanning.

↓
2 Endpoint Layer (EDR + NGAV) — The user opens the attachment. The macro attempts to
execute PowerShell. EDR detects the Excel → PowerShell → network download behaviour
chain (MITRE T1566.001 + T1059.001). NGAV's ML model pre-executes blocks the payload
file. EDR generates a high-severity alert.

↓
3 Network Layer (SWG + NDR) — If the PowerShell download attempt reaches the network: the
SWG checks the destination URL against reputation feeds and blocks the connection. NDR
independently detects the anomalous outbound connection from a finance workstation and
generates a network-level alert.

↓
4 Identity Layer (IAM + MFA + UEBA) — The attacker, having partially succeeded, attempts to
use stolen credentials. MFA blocks the login from the attacker's IP. UEBA detects the login
attempt from an unusual geography and flags the user's risk score. Conditional Access policy
blocks the session pending MFA re-verification on a trusted device.

↓
5 SIEM Correlation — The SIEM receives events from the email gateway (phishing detected), EDR
(PowerShell blocked), NDR (anomalous network behaviour), and identity system (risky login
attempt). Correlation rules match these as a single coordinated attack sequence. A Critical
incident is created, pulling all events into a unified timeline.

↓
6 SOAR Automation — The SOAR playbook triggers immediately: isolate the endpoint via EDR
API; block the attacker's IP on the perimeter firewall; delete the phishing email from all
mailboxes; disable the user's AD account pending investigation; enrich with threat intel (is this
IP part of a known campaign?); create a P1 incident ticket in ServiceNow; page the on-call L2
analyst.

↓
 7 Analyst Investigation — The L2 analyst reviews the SIEM timeline, EDR process tree, and SOAR
enrichment. Confirms the attack origin, validates there is no successful lateral movement,
reviews DLP logs to confirm no data was exfiltrated.

↓
8 Containment & Recovery — Endpoint reimaged from clean baseline. Credentials reset. The
phishing domain is added to the DNS blocklist across all SWG/firewall controls. The attacker's
IOCs are pushed to Threat Intelligence platform and shared with industry peers via ISAC.

↓
9 Lessons Learned — New SIEM detection rule added for the specific macro delivery technique.
Targeted phishing simulation run for the finance team. DMARC policy reviewed and
strengthened on all company domains. Vulnerability in the email gateway sandbox updated.

I N T E G R AT I O N A R C H I T E C T U R E — DATA F LO W S

EDR → process telemetry, alerts → SIEM

Firewall → traffic logs, threat events → SIEM
Email Gateway → phishing alerts, attachment verdicts → SIEM
IAM / AD → authentication logs, account events → SIEM + UEBA
NDR → network detections, flow data → SIEM
CSPM → cloud misconfig findings → SIEM
Threat Intelligence → IOC feeds, TTP context → SIEM + EDR + Firewall + Email Gateway
SIEM → correlated alert → SOAR
SOAR → isolate host command → EDR
SOAR → block IP rule → Firewall
SOAR → delete email from mailbox → Email Gateway / Exchange API
SOAR → disable account → IAM / Active Directory
SOAR → create incident ticket → ServiceNow / Jira

The key architectural principle: Every security tool is both a data source (feeding logs and alerts to the
SIEM) and a response endpoint (receiving automated enforcement actions from SOAR). This
bidirectional integration is what transforms a collection of point products into a coordinated, intelligent
security system.

M AT U R I T Y M O D E L — B U I L D I N G T O W A R D S F U L L I N T E G R AT I O N

Stage Maturity Level Characteristics

Stage Basic Point products deployed. No integration. Manual log review. Reactive
1 security.
 Stage Maturity Level Characteristics

Stage Managed SIEM deployed. Log sources connected. Basic correlation rules. Centralised
2 alerting. Analyst-driven response.

Stage Defined SOAR connected to SIEM. Playbooks automate routine response. Threat intel
3 feeds operational. Metrics tracked.

Stage Quantitatively XDR correlating across all domains. UEBA for insider threat. Full Zero Trust
4 Managed pillars implemented. MTTR measured in minutes.

Stage Optimising AI-driven triage. Autonomous response for defined threat classes.
5 Continuous red team / purple team validation. Threat hunting as a
continuous programme.

A note on tooling vs. process: Technology alone does not create security. The most sophisticated SIEM
provides no value if alerts are not triaged, playbooks are not maintained, and detection rules are never
updated. Effective security requires the right technology, the right processes, and skilled people
working together. Tools amplify the capability of a good security team — they do not replace it.

Cybersecurity Technologies Handbook For Security Architects, SOC Analysts,

Professional Reference — Edition 2025 Engineers & Consultants